Deep Malware Analysis of aba8d9f12cbf913bf04a86cfdf1ebd24 | md5: aba8d9f12cbf913bf04a86cfdf1ebd24 | Html | RAT | Malicious | QuasarRat | Executable | PE (Portable Executable) | Win 32 Exe | x86 | PDB Path | .Net | SOS: 0.60 | Fody/Costura Packer | SOS: 0.20 | SOS: 0.19 | SOS: 0.22 | SOS: 0.23 | SOS: 0.24 | SOS: 0.34 | SOS: 0.29 | SOS: 0.35 | SOS: 0.25 | SOS: 0.14 | SOS: 0.15 | SOS: 0.26 | SOS: 0.32 | SOS: 0.27 | SOS: 0.18

PE Executable

MD5: aba8d9f12cbf913bf04a86cfdf1ebd24

Size: 1.95 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Medium

MD5	aba8d9f12cbf913bf04a86cfdf1ebd24
Sha1	c85b63c678a66646348f72d1b5139b669ff18a9b
Sha256	280f78a77f4bc4fc98ea7d35168446c7e83fba78e467b0aff8edbba9ba8af210
Sha384	3270e37ef6e1396ebf16e67b6ddfa93870587f7610144f702aa547edf56514cfd44169e4ac0c08f2b04e979479530411
Sha512	6387b61b1ebdf4fe92a8173afac2e5d2a6f9804b5c6447c6ed830a42668b1ca3785f4b5e2bff5ef5adf7d6e1a63482bfdb41fc7ea2acc23955cc0ec351b3636b
SSDeep	49152:brZuw7rRFirm+Nn42KK8i7Ltwa+VVaSN:brZueavNnoK8i7LtwbHJ
TLSH	2B95F150B3F58106F1BF6FB9A8B704450B37BA03AA3AD34E498C90AD1FA37519E51367

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void egkzxjztbzgz.THuaLoRs5s8GMb5EZHs0DOwJsmn::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.6.6.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	1528
Main Method	System.Void egkzxjztbzgz.THuaLoRs5s8GMb5EZHs0DOwJsmn::Main()
Main IL Instruction Count	11
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void egkzxjztbzgz.THuaLoRs5s8GMb5EZHs0DOwJsmn::UyEVkriAP1() newobj System.Void egkzxjztbzgz.7CHRk2c37rDfxSZi::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void egkzxjztbzgz.THuaLoRs5s8GMb5EZHs0DOwJsmn::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.6.6.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	1528
Main Method	System.Void egkzxjztbzgz.THuaLoRs5s8GMb5EZHs0DOwJsmn::Main()
Main IL Instruction Count	11
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void egkzxjztbzgz.THuaLoRs5s8GMb5EZHs0DOwJsmn::UyEVkriAP1() newobj System.Void egkzxjztbzgz.7CHRk2c37rDfxSZi::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

PDB Path PATH

?huhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

?huhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

?huhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

protohuhuhuhuhuhuhu

PDB Path PATH

protobhuhuhuhuhuhuhu

PDB Path PATH

E:\A\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

Shahuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

D:\a\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

Sharphuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

E:\A\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

/_/arthuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

PDB Path PATH

?huhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.aforge.dll

PDB Path PATH

?huhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.pulsar.common.dll

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.aforge.video.dll

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.aforge.video.directshow.dll

PDB Path PATH

D:\a\_huhuhuhuhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.system.runtime.compilerservices.unsafe.dll

PDB Path PATH

?huhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.gma.system.mousekeyhook.dll

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.naudio.core.dll

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.naudio.wasapi.dll

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.naudio.winforms.dll

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.naudio.winmm.dll

PDB Path PATH

protohuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.protobuf-net.dll

PDB Path PATH

protobhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.protobuf-net.core.dll

PDB Path PATH

E:\A\_huhuhuhuhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.system.numerics.vectors.dll

PDB Path PATH

Shahuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.sharpdx.dll

PDB Path PATH

SharpDhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.sharpdx.d3dcompiler.dll

PDB Path PATH

D:\a\_huhuhuhuhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.system.memory.dll

PDB Path PATH

SharpDhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.sharpdx.direct2d1.dll

PDB Path PATH

SharpDhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.sharpdx.direct3d11.dll

PDB Path PATH

Sharphuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.sharpdx.dxgi.dll

PDB Path PATH

SharpDhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.sharpdx.mathematics.dll

PDB Path PATH

E:\A\_huhuhuhuhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.system.buffers.dll

PDB Path PATH

/_/arthuhuhuhuhuhuhuhuhuhuhu

aba8d9f12cbf913bf04a86cfdf1ebd24 › .Net Resources › costura.system.collections.immutable.dll

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.